Authentication Bypass in miniOrange OTP Login Plugin for WordPress

CVE-2026-85984

What is CVE-2026-85984?

The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress contains a vulnerability that allows unauthenticated attackers to bypass authentication. This occurs through the use of the mo_wp_login_intent parameter. When the plugin is configured in a specific way, an attacker can submit a POST request with the value 'otp' for this parameter along with a known username and an empty password. The vulnerability arises from a lack of password verification, enabling attackers to log in as any administrator account without needing a password or one-time password (OTP). Exploitation is contingent upon the concurrent activation of specific plugin options that facilitate OTP login methods.

References